Martin Duke's IESG review

[thomas-fossati]

https://mailarchive.ietf.org/arch/msg/tls/0hyoFBsJ_21mv2hUEPPQhmGOMes/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for this document.

Section 9.3.3 of quic-transport, which deals with basically the same security
model, also requires the receiving endpoint to probe the original address, not
just the new one, to address a somewhat more difficult attack. It would be good
to at least RECOMMEND this behavior for DTLS applications, and/or
(repeat/informatively reference) the logic there.

[kaduk]

I opened tlswg/dtls-rrc#3 to (also?) track this.
I'm mostly okay with dtls-connection-id listing a necessary-but-not-necessarily-sufficient list of requirements for migration, and leaving the discussion of both how and what to probe to dtls-rrc.